There really needs to be criminal penalties for this kind of behavior. You can't just let autonomous agents hack people through your own negligence and then claim "oh sorry wasn't me" as a defense.